Ledger investigates wallet drains linked to CryptoBilis reseller; losses may exceed $86 million

Ledger looks into tampered devices sold through CryptoBilis

Hardware wallet maker Ledger said it is investigating reports that funds were stolen from users in Southeast Asia who bought its devices from reseller CryptoBilis. The cause of the losses is not yet known.

CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia, and the Philippines. Ledger has asked the company to pause all sales and shipments while the investigation runs.

One onchain researcher estimated that more than $72 million had moved to suspected theft addresses. A second researcher later traced funds to addresses on Bitcoin, Ethereum, and Tron and put the total above $86 million. Neither figure has been independently confirmed.

What Ledger is advising customers to do

A hardware wallet is a physical device used to store crypto assets offline. Ledger said anyone who bought from CryptoBilis in the last 90 days should not set up their device if they have not already done so. People who have already set up a device should consider moving their funds to a new wallet created with a fresh recovery phrase.

Ledger said it will share updates as the investigation continues.

Industry voices weigh in

Former Mt. Gox CEO Mark Karpeles said the reports could connect to an issue he was already looking into. He asked affected users to send him pictures of the inside circuit boards of their Ledger devices to check for signs of tampering.

Binance co-founder Changpeng Zhao suggested the losses may point to a supply chain attack involving a single vendor. He said some users may have received fake or altered devices.

Why the damage numbers are uncertain

Researcher Specter initially said hundreds of victim wallets were involved, then later said the actual number of affected wallets was still unknown. It is also unclear whether the two loss estimates cover the same transactions and addresses.

What we know for sure

Ledger is investigating reports of fund losses among buyers from reseller CryptoBilis. Sales and shipments to the region have been paused. Buyers from the past 90 days are being warned not to set up affected devices or to move assets to new wallets. The total amount lost and the exact cause remain unconfirmed.

Where to find updates

Ledger said it will continue to inform customers as the investigation progresses. Affected users have been asked to contact the crypto security response group SEAL 911.

Sources

• The Block

Read also: Ledger probes device-linked thefts worth tens of millions